With Internet use forming an ever greater part of day to day life, security exploits that steal or destroy system resources, data, and private information are an increasing problem. Governments and businesses devote significant resources to preventing intrusions and thefts related to these security exploits. Security exploits come in many forms, such as computer viruses, worms, trojan horses, spyware, keystroke loggers, adware, and rootkits. These exploits are delivered in or through a number of mechanisms, such as spearfish emails, clickable links, documents, executables, or archives. Some of the threats posed by security exploits are of such significance that they are described as cyber terrorism or industrial espionage.
To aid in countering such threats, vendors of anti-virus software will often register hooks with an operating system of a monitored device or hook system library components (e.g., the NTDLL component in WINDOWS® operating systems, or glibc component on UNIX Systems) implemented in processes of the monitored device. Vendors of anti-virus software typically operate in user-mode, however, and cannot hook components implemented in processes until those processes are loaded. This delay provides security exploits with an opportunity to insert themselves into such processes and harden against detection by anti-virus software. Further, advances in operating systems, such as advances from 32-bit operating systems to 64-bit operating systems, may hinder the ability of anti-virus software to hook functions of certain components, such as 64-bit versions of system components operating in 32-bit application processes.
Hooking processes also can involve difficulties. The component hooking a process may have to deal with race conditions and be required to use thread suspension techniques in order to safely hook a function in such a process.